CN110430014B - Hardware encryption gateway and encryption method for field bus channel encryption - Google Patents
Hardware encryption gateway and encryption method for field bus channel encryption Download PDFInfo
- Publication number
- CN110430014B CN110430014B CN201910653667.4A CN201910653667A CN110430014B CN 110430014 B CN110430014 B CN 110430014B CN 201910653667 A CN201910653667 A CN 201910653667A CN 110430014 B CN110430014 B CN 110430014B
- Authority
- CN
- China
- Prior art keywords
- encryption
- module
- key
- gateway
- algorithm
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
- G06F13/38—Information transfer, e.g. on bus
- G06F13/42—Bus transfer protocol, e.g. handshake; Synchronisation
- G06F13/4282—Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus
- G06F13/4286—Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus using a handshaking protocol, e.g. RS232C link
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L1/00—Arrangements for detecting or preventing errors in the information received
- H04L1/004—Arrangements for detecting or preventing errors in the information received by using forward error control
- H04L1/0056—Systems characterized by the type of code used
- H04L1/0061—Error detection codes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
- H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2213/00—Indexing scheme relating to interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
- G06F2213/0002—Serial port, e.g. RS232C
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Power Engineering (AREA)
- Small-Scale Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses a field bus channel encryption method in a water conservancy automation control system, which realizes transparent encryption of a protocol data unit by deploying a hardware encryption gateway between automation control equipment and a field bus. In the hardware encryption gateway, the functions of automatic control equipment identity verification, field bus communication data confidentiality and protocol packet integrity verification are realized through a domestic mixed encryption scheme combining a symmetric encryption algorithm and an asymmetric encryption algorithm, unauthorized illegal equipment is effectively prevented from monitoring, intercepting and tampering data monitoring and control information on a channel of a field bus, the hardware encryption gateway has higher resistance to man-in-the-middle attack, and the safety risk caused by the fact that the field bus channel is invaded in a water conservancy automatic control system is reduced. The hardware encryption gateway can be seamlessly connected into the field bus of the existing hydraulic automatic control system, and has high equipment compatibility and universality.
Description
Technical Field
The invention belongs to the technical field of information, and particularly relates to a field bus channel encryption method and an encryption gateway in a water conservancy automation control system.
Background
In the water conservancy automatic control system deployed at present in China, a Field Bus (Field Bus) network is mostly adopted to carry out networking on a Programmable Logic Controller (PLC) and a lower computer. The reason for this is that physical layer media used in computer networks, such as STP, single mode or multimode optical fiber, etc., have physical properties that do not satisfy the industrial application scenario of high weather resistance and high strength. The RS232/485 cable has more than twenty years of application history in an industrial automation control system due to excellent performance and price advantage, and cannot be replaced in a short time. However, the cost for implementing the modification is too high when the existing physical layer needs to be replaced, and even the cost is higher than the cost for initially deploying the system. If wireless networking is used, the reliability and stability of the network are reduced, and the method cannot be implemented in a signal shielding scene, so that the method has high limitation.
At present, most of the PLCs used by the water conservancy automation control system do not have the computer network communication capability and must be matched with matched hardware interfaces. The transformation of the existing equipment also has the condition of overhigh implementation cost, and needs to consider the different requirements of electrical and interface specifications among different manufacturers, so that the cost performance is low. Although the Modbus TCP protocol supports transparent transmission in a computer network, the Modbus TCP protocol is simple to implement, cannot support the security characteristics of a network layer and a transmission layer in a TCP/IP protocol, needs to be specially modified for a network module, and is not strong in universality.
Most electrical engineers only have development experience of data communication in a field bus network, and if a computer network is used for replacing the field bus, enough personnel support is required, which means that a related knowledge system, training materials, courses, practices and processes need to be established. Because the training period of the current electrical engineer is long, the personnel foundation for implementing computer networking reconstruction is not available.
In summary, the idea of multiplexing relevant theories and technologies in a computer network to solve the safety problem of the fieldbus network in the hydraulic automation control system has a very high limitation under the current personnel and technical conditions.
Therefore, how to provide a set of Encryption Scheme with low cost and high applicability for a field bus channel on the premise of reducing the reconstruction cost is a subject with higher research and application values by realizing the functions of automatic control equipment identity verification, field bus communication data confidentiality and protocol grouping integrity verification through a domestic mixed Encryption Scheme (Hybrid Encryption Scheme) combining a symmetric Encryption algorithm and an asymmetric Encryption algorithm.
Disclosure of Invention
The purpose of the invention is as follows: aiming at the problems, the invention provides a field bus channel encryption method and an encryption gateway in a water conservancy automation control system, which realize the functions of automatic control equipment identity authentication, field bus communication data confidentiality and protocol packet integrity verification.
The technical scheme is as follows: in order to realize the purpose of the invention, the technical scheme adopted by the invention is as follows: a hardware encryption gateway for field bus channel encryption is composed of two serial port communication modules, an encryption module, a key storage module and a power supply module.
The two serial port communication modules are respectively connected with the automation control equipment and the network physical interface of the field bus and used for receiving or sending serial port communication protocol packets. The two serial port communication modules are respectively connected with the encryption module through high-speed serial data bus interfaces. The network physical interface used by the serial port communication module comprises but is not limited to an electrical interface conforming to RS485/232 standard. The high-speed serial data bus interface used by the serial communication module includes, but is not limited to, bus interfaces conforming to UART, I2C and SPI standards.
The encryption module is a single chip System (SOC), and can realize an asymmetric encryption algorithm, a symmetric encryption algorithm, a hash algorithm and a random key generation algorithm through software codes of a built-in register or hardware equipment of an arithmetic logic unit. Wherein, the asymmetric encryption algorithm includes but is not limited to SM2, ECC, RSA algorithm, the symmetric encryption algorithm includes but is not limited to SM1, RC4, AES algorithm, the hash algorithm includes but is not limited to SM3, MD5, SHA-1 algorithm. The encryption module is connected with the serial port communication module through a high-speed serial data bus interface, connected with the key storage module through a data bus and address bus interface and connected with the power supply module through a power line interface.
The key storage module is a flash read-only memory. The gateway stores the destination address code, and the corresponding public key and private key through a key storage module. The key storage module is connected with the encryption module through a data bus and an address bus interface, and the interface includes but is not limited to an expansion bus interface conforming to eMMC and UFS standards.
The power supply module is a direct current power supply. The gateway supplies power through the power supply module, and the power supply module converts the input of a wide-voltage direct-current power supply on the field bus into voltage and current meeting the working condition requirements of the gateway. The power supply module is connected with the encryption module through a two-core (VCC, GND) power line interface, and the input voltage is 12V to 24V.
Two serial communication modules of the hardware encryption gateway are respectively connected with the automation control equipment and the network physical interface of the field bus, wherein the serial communication module connected with the network physical interface of the automation control equipment is called an equipment end, and the serial communication module connected with the network physical interface of the field bus is called a field bus end.
A field bus channel encryption method in a water conservancy automation control system comprises the following steps:
s1: and a hardware encryption gateway is respectively connected between each automation control device connected to the field bus and the network physical interface of the field bus, and a corresponding key and a destination address code are written in a key storage module of the hardware encryption gateway in advance. The automatic control equipment comprises but is not limited to a PLC, a lower computer, a sensor and a controller.
S2: after a power supply module of the hardware encryption gateway starts working, the hardware encryption gateway is started, and a key storage module of the hardware encryption gateway is initialized; if the initialization process is completed, go to step S3; if the initialization process is terminated, subsequent operation is not executed; the initialization process is as follows:
(2-1) searching all stored destination address codes in the key storage module, and public key and private key records corresponding to the destination address codes;
(2-2) storing at least one address code of an entry and a private key corresponding to the address code in the key storage module; judging whether the private key record number is unique, and entering the step (2-3) if the private key record number is unique; otherwise, the initialization process is terminated, and subsequent operation is not executed;
(2-3) storing at least one address code of an item and a public key corresponding to the address code in the key storage module; judging whether the number of public key records is greater than or equal to 1, if so, finishing the initialization process; otherwise, the initialization process terminates and no subsequent operations are performed.
S3: after the key storage module of the hardware encryption gateway is initialized, starting to execute a monitoring process; the monitoring process comprises two parts: firstly, monitoring all serial port communication Application Data Units (ADUs) transmitted into a hardware encryption gateway on a serial port communication module connected with a field bus end; secondly, monitoring all serial port communication Application Data Units (ADUs) transmitted into the hardware encryption gateway on a serial port communication module of the connection equipment end; the method comprises the following steps:
(3-1) monitoring all serial port communication Application Data Units (ADUs) transmitted into the hardware encryption gateway on a serial port communication module connected with a field bus end;
and (3-1-1) when the serial port communication module of the hardware encryption gateway connected with the field bus end receives the incoming serial port communication application data unit ADU, sending an interrupt request to the encryption module. The encryption module responds to the interrupt and enters an interrupt processing process, the check code CRC at the tail of the application data unit ADU is used for checking the data of the rest part except the CRC in the unit, and a check algorithm uses a hash algorithm preset inside the encryption module, including but not limited to SM3, MD5 and SHA-1 algorithm.
(3-1-2) if the verification fails, the encryption module interrupts the return and does not respond to the application data unit ADU. If the verification is successful, the encryption module searches a private key PRK or a public key PUK corresponding to the destination address code ADDR in the key management module through the destination address code ADDR of the application data unit ADU header. ADDR is Hexadecimal (HEX) data greater than or equal to 1 byte.
(3-1-3) if the private key PRK or the public key PUK does not exist, the encryption module interrupts to return, and does not respond to the application data unit ADU; if the private key PRK or the public key PUK exists, the private key PRK or the public key PUK is used, and a symmetric key ciphertext CK located at the head of a Protocol Data Unit (PDU) in an Application Data Unit (ADU) is decrypted through an asymmetric encryption algorithm built in an encryption module, so that a symmetric key RK is obtained. Asymmetric encryption algorithms include, but are not limited to, SM2, ECC, RSA algorithms.
And (3-1-4) decrypting the encapsulated data load ciphertext EC of the part except the header in the protocol data unit PDU by using the symmetric key RK through a symmetric encryption algorithm built in the encryption module to obtain an encapsulated data load EP. The encapsulated data payload EP consists of a data plaintext PD at its head and a hash data DH at its tail. Symmetric encryption algorithms include, but are not limited to, SM1, RC4, AES algorithm.
(3-1-5) the encryption module uses the data plaintext PD at the head of the EP to calculate a plaintext hash value PH through a built-in hash algorithm and compares the plaintext hash value PH with the hash data DH at the tail of the EP. Hashing algorithms include, but are not limited to, the SM3, MD5, SHA-1 algorithms.
(3-1-6) if the plaintext hash value PH is different from the hash data DH, interrupting the return of the encryption module, discarding the application data unit ADU, and not responding; if the plaintext hash PH is the same as the hash data DH, the data plaintext PD is used as a new protocol data unit PDU 2. The destination address code ADDR is appended to the PDU2 header, the check code CRC2 of PDU2 is calculated and appended to the PDU2 tail as a new application data unit ADU 2. The verification algorithm uses internally preset hashing algorithms in the cryptographic module including, but not limited to, the SM3, MD5, SHA-1 algorithms.
And (3-1-7) sending the ADU2 through a serial port communication module of the equipment side.
(3-2) monitoring all serial port communication Application Data Units (ADUs) transmitted into the hardware encryption gateway on a serial port communication module of the connection equipment end;
and (3-2-1) when the serial port communication module of the gateway connection equipment end receives the incoming serial port communication application data unit ADU, sending an interrupt request to the encryption module. The encryption module responds to the interrupt and enters an interrupt processing process, the check code CRC at the tail of the application data unit ADU is used for checking the data of the rest part except the CRC in the unit, and a check algorithm uses a hash algorithm preset inside the encryption module, including but not limited to SM3, MD5 and SHA-1 algorithm.
(3-2-2) if the verification fails, the encryption module interrupts the return and does not respond to the application data unit ADU. If the verification is successful, the encryption module searches a public key PUK or a private key PRK corresponding to the destination address code ADDR in the key management module through the destination address code ADDR of the application data unit ADU header. Where ADDR is Hexadecimal (HEX) data greater than or equal to 1 byte.
(3-2-3) if the public key PUK or the private key PRK does not exist, the encryption module interrupts to return, and does not respond to the application data unit ADU; if the public key PUK or the private key PRK exists, a protocol data unit PDU in an application data unit ADU is used as a data plaintext PD, a plaintext hash value PH is calculated through a built-in hash algorithm, and the PH is attached to the tail of the data plaintext PD to form an encapsulated data load EP. Hashing algorithms include, but are not limited to, the SM3, MD5, SHA-1 algorithms.
And (3-2-4) generating a random symmetric key RK through a built-in random key generation algorithm, and encrypting the encapsulated data load EP through a built-in symmetric encryption algorithm by using the RK to obtain an encapsulated data load ciphertext EC. Symmetric encryption algorithms include, but are not limited to, SM1, RC4, AES algorithm.
And (3-2-5) encrypting the random symmetric key RK by using the public key PUK or the private key PRK through a built-in asymmetric encryption algorithm to obtain a symmetric key ciphertext CK. Asymmetric encryption algorithms include, but are not limited to, SM2, ECC, RSA algorithms.
(3-2-6) appending the symmetric key ciphertext CK to the encapsulated data payload ciphertext EC header as a new protocol data unit PDU 2. The destination address code ADDR is appended to the PDU2 header, the check code CRC2 of the PDU2 is calculated and appended to the PDU2 tail as a new application data unit ADU2, the check algorithm using internally preset hashing algorithms in the cryptographic module, including but not limited to SM3, MD5, SHA-1 algorithms.
(3-2-7) sending the ADU2 through a serial port communication module of the field bus end.
S4: after the hardware encryption gateway starts to perform the listening process, the listening process is terminated if and only if the power module stops supplying power. Otherwise, the listening process is always performed. After the power supply module stops supplying power, if and only if power is supplied again, the hardware encryption gateway re-executes the initialization process of step S2 and the listening process of step S3.
Has the advantages that: compared with the prior art, the technical scheme of the invention has the following beneficial technical effects:
the invention realizes the transparent encryption of Protocol Data Unit (PDU) by arranging the hardware encryption gateway between the field bus and the automation control equipment such as the upper computer and the lower computer of the water conservancy automation control system and utilizing public key encryption, private key encryption, random encryption and Data hash algorithm, provides the functions of the authentication of the automation control equipment, the confidentiality of field bus communication Data and the verification of Protocol grouping integrity, can effectively prevent unauthorized illegal equipment from monitoring, intercepting and tampering Data monitoring and control information on the channel of the field bus, has higher resistance to man-in-the-middle attack, and reduces the safety risk caused by the invasion of the field bus channel in the water conservancy automation control system. Compared with a link layer plaintext data transmission mode adopted in the existing field bus, the method can provide reliable safety guarantee for a water conservancy automation control system serving as a key infrastructure in the national economy field. The invention has higher compatibility and universality, does not need to change the topology of a field bus network and a physical layer transmission medium, and can realize the low-cost transformation of the existing water conservancy automatic control system.
Drawings
FIG. 1 is a diagram of a hardware encryption gateway architecture;
FIG. 2 is a schematic diagram of a device connection;
FIG. 3 is a communication packet data structure from a Fieldbus end to a device end during snooping;
FIG. 4 is a block diagram of a device-to-fieldbus end communication packet data structure during snooping;
FIG. 5 is an initialization process flow diagram;
FIG. 6 is a flow chart of a fieldbus end snooping process;
fig. 7 is a flow chart of a device side listening process.
Detailed Description
The technical solution of the present invention is further described below with reference to the accompanying drawings and examples.
The invention relates to a hardware encryption gateway for field bus channel encryption, which consists of two serial port communication modules, an encryption module, a key storage module and a power supply module. The gateway architecture is shown in fig. 1, and the field bus connections to the devices are shown in fig. 2.
Each serial port communication module consists of a serial communication chip, the model of the chip is ADM485, the chip is respectively connected with the encryption module through a UART bus interface, and an RS485 interface is used for connecting external equipment;
the encryption module is composed of a single chip microcomputer system based on an ACH512 chip, hardware of SM1, SM2, SM3 and SM4 algorithms are preset inside the encryption module, the encryption module is connected with a serial port communication module through a UART bus interface, connected with a key storage module through an address bus interface, and connected with a power supply module through a two-core (VCC, GND) power line interface.
The key storage module consists of a Flashrom chip and is connected with the encryption module through an NAND Flash interface.
The power supply module consists of a voltage-stabilizing direct-current circuit, obtains electricity from a field bus through an RS485 interface, is connected with the encryption module through a two-core (VCC, GND) power line interface, and provides standard working voltage and current of the encryption module.
In a water conservancy automation control system, automation control equipment D1, D2 and D3 are respectively arranged on the same field bus, wherein D1 is an upper computer and is set to be in a master mode, and the address is 0x 01; d2 and D3 are lower computers, set in slave mode, and have addresses of 0x02 and 0x03, respectively.
The invention relates to a field bus channel encryption method in a water conservancy automation control system, which comprises the following steps:
s1: the burning program is used in advance to write the keys into the key storage modules of the hardware encryption gateways G1, G2 and G3 according to the following rules:
in G1, write the private key of address 0x01, D1 of D1; write the public key of address 0x02, D2 of D2; write the public key of address 0x03, D3 of D3.
In G2, write the private key of address 0x02, D2 of D2; write the public key of address 0x01, D1 of D1.
In G3, write the private key of address 0x03, D3 of D3; write the public key of address 0x01, D1 of D1.
Hardware encryption gateways G1, G2, G3 are deployed between the devices D1, D2, D3 and the fieldbus, respectively: the device side serial port communication module of G1 is connected with D1, and the bus side serial port communication module of G1 is connected with a field bus; the device side serial port communication module of G2 is connected with D2, and the bus side serial port communication module of G2 is connected with a field bus; the device side serial port communication module of G3 is connected with D3, and the bus side serial port communication module of G3 is connected with the field bus.
S2: after the power supply modules of G1, G2 and G3 start to operate, G1, G2 and G3 start to perform initialization process on the key storage modules of G1, G2 and G3, and the process is as shown in fig. 5. The initialization process is as follows:
searching all stored destination address codes in the key storage module, and public key and private key records corresponding to the destination address codes; judging whether the private key record number is unique, if not, terminating the initialization process, and not executing subsequent operation; if the public key record number is unique, judging whether the public key record number is greater than or equal to 1, and if the public key record number is greater than or equal to 1, finishing the initialization process; otherwise, the initialization process terminates and no subsequent operations are performed.
Since the key written in the above step S1 meets the requirements of the initialization process, the initialization process is completed, and G1, G2, and G3 start to perform the listening process.
S3: when the D1 sends the serial communication application data unit ADU to the D2, the device side serial communication module of G1 generates an interrupt with the destination address of the ADU encoded as 0x02, and the encryption module thereof starts entering an interrupt processing process in response to the interrupt, as shown in fig. 7. Since the public key of D2 is written in G1, the original ADU sent by D1 becomes an encrypted ADU after being processed by G1, and enters the fieldbus, and the communication packet data structure is as shown in fig. 4.
When the G2 receives the encrypted ADU sent by G1, the serial port communication module at the bus end of G2 generates an interrupt, and the encryption module thereof starts entering an interrupt processing process in response to the interrupt, as shown in fig. 6. Because the private key of D2 is written in G2, ADU sent out by G1 is processed by G2 and then restored to plaintext, and transmitted to D2, and the communication packet data structure is as shown in fig. 3. At this time, D2 receives the serial communication application data unit ADU sent by D1, may perform related operations, and may feed back data to D1.
Since the ADU destination address returned by the slave device to the master in the Modbus protocol is always the device address, and the packet destination address returned is 0x02, the device port serial port communication module in G2 generates an interrupt, and its encryption module responds to the interrupt and starts to enter the interrupt processing process, as shown in fig. 7. Because the private key of D2 is written in G2, the original ADU sent by D2 becomes an encrypted ADU after being processed by G2, and enters the fieldbus through the serial port communication module at the bus end of G2, and the communication packet data structure is as shown in fig. 4.
When the G1 receives the encrypted ADU sent by the G2, the serial port communication module at the bus end of the G1 generates an interrupt, and the encryption module of the G1 starts entering an interrupt processing process in response to the interrupt, as shown in fig. 6. Because the public key of D2 is written in G1, the ADU sent out by G2 is restored to plaintext after being processed by G1, and is transmitted to D1 through the device-side serial port communication module of G1, and the structure of the communication packet data is as shown in fig. 3.
Assuming that a malicious attacker connects a malicious device D4 directly to the fieldbus without passing through a hardware encryption gateway, the D4 address is 0x 04. The attacker knows that the address of the master device D1 is 0x01, and tries to send a malicious packet P to D1, because the destination address of the ADU returned by the slave device to the master in the Modbus protocol is always the device address, and the destination address of P is 0x 04. G1 receives P and checks if there is address 0x04 and its corresponding public key in the key storage module. Since the address and public key do not exist, G1 discards P and the attack fails.
The malicious attacker tries to pretend to be D3 by using D4, and sends a malicious packet PP to D1, because the destination address of the ADU returned by the slave device to the master in the Modbus protocol is always the device address, and the destination address of the PP is 0x 03. After the G1 receives the PP, it checks whether the address 0x03 and its corresponding public key exist in the key storage module. Because of the existence of the address and public key, G1 decrypts the PP using the public key of D3. Since the D4 cannot acquire the private key of the D3 in the G3 key storage module, the PP inevitably fails in the verification process of the G1, the G1 discards the PP, and the attack fails.
And after the D3 is removed from the G3 by a malicious attacker, the D4 is used for connecting the serial port communication module of the device end of the G3, and the malicious packet PPP is sent to the D1. Because the addresses of D3 and D4 are different, G3 cannot find the address 0x04 and its corresponding private key in the key storage module, and G3 discards PPP and fails the attack.
The embodiments are only for illustrating the technical idea of the present invention, and the technical idea of the present invention is not limited thereto, and any modifications made on the basis of the technical scheme according to the technical idea of the present invention fall within the scope of the present invention.
Claims (4)
1. A hardware encryption gateway for fieldbus channel encryption, comprising: the gateway consists of two serial port communication modules, an encryption module, a key storage module and a power supply module; the two serial port communication modules are respectively connected with the automation control equipment and a network physical interface of the field bus; the two serial port communication modules are respectively connected with the encryption module through high-speed serial data bus interfaces; the encryption module is a single chip System (SOC) and is connected with the key storage module through a data bus and an address bus interface and is connected with the power supply module through a power line interface; the key storage module is a flash read-only memory; the power supply module is a direct current power supply;
the encryption module realizes an asymmetric encryption algorithm, a symmetric encryption algorithm, a hash algorithm and a random key generation algorithm through software codes of a built-in register or hardware equipment of an arithmetic logic unit; the asymmetric encryption algorithm comprises SM2, ECC and RSA algorithms, the symmetric encryption algorithm comprises SM1, RC4 and AES algorithms, and the hash algorithm comprises SM3, MD5 and SHA-1 algorithms; the key storage module is used for storing a unique private key and a plurality of public keys;
firstly, monitoring all serial port communication Application Data Units (ADUs) transmitted into a hardware encryption gateway on a serial port communication module connected with a field bus end;
(3-1-1) when a serial port communication module of a hardware encryption gateway connection field bus end receives an incoming serial port communication Application Data Unit (ADU), sending an interrupt request to an encryption module; the encryption module responds to the interrupt and enters an interrupt processing process, the check code CRC at the tail of the application data unit ADU is used for checking the data of the rest part except the CRC in the unit, and the check algorithm uses a hash algorithm preset in the encryption module;
(3-1-2) if the verification fails, the encryption module interrupts the return and does not respond to the Application Data Unit (ADU); if the verification is successful, the encryption module searches a private key PRK or a public key PUK corresponding to the destination address code ADDR in the key management module through the destination address code ADDR of the ADU header of the application data unit; ADDR is Hexadecimal (HEX) data of greater than or equal to 1 byte;
(3-1-3) if the private key PRK or the public key PUK does not exist, the encryption module interrupts to return, and does not respond to the application data unit ADU; if the private key PRK or the public key PUK exists, decrypting a symmetric key ciphertext CK located at the head of a Protocol Data Unit (PDU) in an Application Data Unit (ADU) by using the private key PRK or the public key PUK through an asymmetric encryption algorithm built in an encryption module to obtain a symmetric key RK;
(3-1-4) decrypting the encapsulated data load ciphertext EC of the part except the header in the protocol data unit PDU by using the symmetric key RK through a symmetric encryption algorithm built in an encryption module to obtain an encapsulated data load EP; the encapsulated data payload EP consists of a data plaintext PD at the head thereof and a hash data DH at the tail thereof;
(3-1-5) the encryption module uses the data plaintext PD at the head part of the EP, calculates a plaintext hash value PH through a built-in hash algorithm, and compares the plaintext hash value PH with the hash data DH at the tail part of the EP;
(3-1-6) if the plaintext hash value PH is different from the hash data DH, interrupting the return of the encryption module, discarding the application data unit ADU, and not responding; if the plaintext hash value PH is the same as the hash data DH, taking the data plaintext PD as a new protocol data unit PDU 2; attaching the destination address code ADDR to the PDU2 header, calculating the check code CRC2 of PDU2 and attaching it to the PDU2 trailer as a new application data unit ADU 2; the verification algorithm uses a hash algorithm preset in the encryption module;
(3-1-7) sending the ADU2 through a serial port communication module of the equipment end;
secondly, monitoring all serial port communication Application Data Units (ADUs) transmitted into the hardware encryption gateway on a serial port communication module of the connection equipment end;
(3-2-1) when the serial port communication module of the gateway connection equipment end receives an incoming serial port communication Application Data Unit (ADU), sending an interrupt request to an encryption module; the encryption module responds to the interrupt and enters an interrupt processing process, the check code CRC at the tail of the application data unit ADU is used for checking the data of the rest part except the CRC in the unit, and the check algorithm uses a hash algorithm preset in the encryption module;
(3-2-2) if the verification fails, the encryption module interrupts the return and does not respond to the Application Data Unit (ADU); if the verification is successful, the encryption module searches a public key PUK or a private key PRK corresponding to a target address code ADDR in a key management module through the target address code ADDR of the ADU header of the application data unit; wherein ADDR is Hexadecimal (HEX) data of greater than or equal to 1 byte;
(3-2-3) if the public key PUK or the private key PRK does not exist, the encryption module interrupts to return, and does not respond to the application data unit ADU; if the public key PUK or the private key PRK exists, a protocol data unit PDU in an application data unit ADU is used as a data plaintext PD, a plaintext hash value PH is calculated through a built-in hash algorithm, and the PH is attached to the tail of the data plaintext PD to form an encapsulated data load EP;
(3-2-4) generating a random symmetric key RK through a built-in random key generation algorithm, and encrypting the encapsulated data load EP through a built-in symmetric encryption algorithm by using the RK to obtain an encapsulated data load ciphertext EC;
(3-2-5) encrypting the random symmetric key RK by using a public key PUK or a private key PRK through a built-in asymmetric encryption algorithm to obtain a symmetric key ciphertext CK;
(3-2-6) appending the symmetric key ciphertext CK to the encapsulated data payload ciphertext EC header as a new protocol data unit PDU 2; attaching the destination address code ADDR to the PDU2 header, calculating the check code CRC2 of the PDU2 and attaching it to the PDU2 tail as a new application data unit ADU2, the check algorithm using a hash algorithm preset internally in the encryption module;
(3-2-7) sending the ADU2 through a serial port communication module of the field bus end.
2. A hardware encryption gateway for fieldbus channel encryption according to claim 1, further comprising: the network physical interface used by the serial communication module comprises an electrical interface conforming to the RS485/232 standard, and the high-speed serial data bus interface used by the serial communication module comprises a bus interface conforming to the UART, I2C and SPI standards; the data bus and address bus interface of the key storage module comprises an expansion bus interface conforming to eMMC and UFS standards.
3. A hardware encryption gateway for fieldbus channel encryption according to claim 1, further comprising: each serial port communication module consists of a serial communication chip, the model of the chip is ADM485, the chip is respectively connected with the encryption module through a UART bus interface, and an RS485 interface is used for connecting external equipment; the encryption module consists of a singlechip system based on an ACH512 chip; the key storage module consists of a Flashrom chip and is connected with the encryption module through an NAND Flash interface.
4. A fieldbus channel encryption method implemented by a hardware encryption gateway according to any one of claims 1 to 3, further comprising: the method comprises the following steps:
s1: respectively connecting a hardware encryption gateway between each piece of automation control equipment connected to the field bus and a network physical interface of the field bus, and writing a corresponding key and a destination address code in a key storage module of the hardware encryption gateway in advance;
s2: after a power supply module of the hardware encryption gateway starts working, the hardware encryption gateway is started, and a key storage module of the hardware encryption gateway is initialized; if the initialization process is completed, go to step S3; if the initialization process is terminated, subsequent operation is not executed;
s3: after the key storage module of the hardware encryption gateway is initialized, starting to execute a monitoring process;
s4: after the hardware encryption gateway starts to execute the monitoring process, if and only if the power supply module stops supplying power, the monitoring process is terminated; otherwise, the monitoring process is always executed; after the power supply module stops supplying power, if and only if power is supplied again, the hardware encryption gateway re-executes the initialization process of step S2 and the listening process of step S3;
the initialization process of step S2 is as follows:
(2-1) searching all stored destination address codes in the key storage module, and public key and private key records corresponding to the destination address codes;
(2-2) judging whether the private key record number is unique, and if the private key record number is unique, entering the step (2-3); otherwise, the initialization process is terminated, and subsequent operation is not executed;
(2-3) judging whether the number of the public key records is greater than or equal to 1, if so, finishing the initialization process; otherwise, the initialization process terminates and no subsequent operations are performed.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910653667.4A CN110430014B (en) | 2019-07-19 | 2019-07-19 | Hardware encryption gateway and encryption method for field bus channel encryption |
| PCT/CN2020/085959 WO2021012728A1 (en) | 2019-07-19 | 2020-04-21 | Channel encryption method for fieldbus in water management automation control system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910653667.4A CN110430014B (en) | 2019-07-19 | 2019-07-19 | Hardware encryption gateway and encryption method for field bus channel encryption |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110430014A CN110430014A (en) | 2019-11-08 |
| CN110430014B true CN110430014B (en) | 2022-02-01 |
Family
ID=68410080
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910653667.4A Active CN110430014B (en) | 2019-07-19 | 2019-07-19 | Hardware encryption gateway and encryption method for field bus channel encryption |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN110430014B (en) |
| WO (1) | WO2021012728A1 (en) |
Families Citing this family (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110430014B (en) * | 2019-07-19 | 2022-02-01 | 河海大学 | Hardware encryption gateway and encryption method for field bus channel encryption |
| CN110557244B (en) * | 2019-09-06 | 2021-12-28 | 江苏省水文水资源勘测局 | Application data unit encryption method in water conservancy industrial control system |
| CN111526158A (en) * | 2020-05-21 | 2020-08-11 | 无锡极地之光信息技术有限公司 | Safety transmitter device for field bus |
| CN111885062B (en) * | 2020-07-23 | 2022-06-24 | 湖南中车时代通信信号有限公司 | RS485 bus-based communication system and method with authentication encryption function |
| CN112835841A (en) * | 2021-03-05 | 2021-05-25 | 大唐半导体科技有限公司 | ASIC data safe transmission and storage device and method based on serial port communication |
| JP7161583B1 (en) * | 2021-06-29 | 2022-10-26 | ウィンボンド エレクトロニクス コーポレーション | semiconductor equipment |
| CN113612757A (en) * | 2021-07-29 | 2021-11-05 | 四川福泰美科技有限公司 | Method and system for safely accessing industrial Internet of things terminal to network |
| CN114143013A (en) * | 2021-12-16 | 2022-03-04 | 郑州轨道交通信息技术研究院 | Gateway authorization method based on MD5, RC4 encryption and zmq communication |
| CN114938304B (en) * | 2022-05-23 | 2023-04-28 | 贵州大学 | Method and system for safely transmitting industrial Internet of things data |
| CN115484131B (en) * | 2022-08-31 | 2024-04-12 | 江苏奥立信数字科技有限公司 | Internet of things gateway and equipment data storage system for same |
| CN115987688B (en) * | 2023-03-20 | 2023-08-01 | 北京网藤科技有限公司 | Method and system for guaranteeing safe communication between PLC and upper computer |
| CN117459557B (en) * | 2023-12-22 | 2024-03-15 | 广州晟能电子科技有限公司 | Fusion method of low-code Internet of things multidimensional data |
| CN117828648B (en) * | 2024-03-06 | 2024-05-28 | 湖南博匠信息科技有限公司 | Method for implementing trusted bus interaction system |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2008299683A (en) * | 2007-06-01 | 2008-12-11 | Nippon Telegr & Teleph Corp <Ntt> | Security method for information recording medium, information processing device, and program |
| CN101799681A (en) * | 2010-02-10 | 2010-08-11 | 刘文祥 | Intelligent grid |
| CN102014015A (en) * | 2010-06-29 | 2011-04-13 | 北京飞天诚信科技有限公司 | Self-checking method of intelligent secret key equipment |
| CN102411352A (en) * | 2011-11-02 | 2012-04-11 | 北京必创科技有限公司 | Wireless analog control method, device and system |
| US8363837B2 (en) * | 2005-02-28 | 2013-01-29 | HGST Netherlands B.V. | Data storage device with data transformation capability |
| CN103679062A (en) * | 2013-12-23 | 2014-03-26 | 上海贝岭股份有限公司 | Intelligent electric meter main control chip and security encryption method |
| CN103872778A (en) * | 2014-03-15 | 2014-06-18 | 内蒙古大唐国际新能源有限公司 | Wind power control center device arranged in redundant mode |
| CN104092772A (en) * | 2014-07-23 | 2014-10-08 | 江苏敏捷科技股份有限公司 | High-speed and high-pass data security storage and transmission method |
| CN107566353A (en) * | 2017-08-21 | 2018-01-09 | 浙江大学 | A kind of industrial control system safety experiment platform for encrypted master experimental study |
| CN109639438A (en) * | 2019-02-26 | 2019-04-16 | 燕山大学 | A kind of SCADA network industries information ciphering method based on digital signature |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102231690A (en) * | 2011-03-31 | 2011-11-02 | 华立仪表集团股份有限公司 | Remote meter reading method of public utility meter |
| DE102016125511A1 (en) * | 2016-12-22 | 2018-06-28 | Abb Schweiz Ag | Safety device and fieldbus system to support secure communication over a fieldbus |
| CN106899404B (en) * | 2017-02-15 | 2020-06-02 | 同济大学 | Vehicle-mounted CAN FD bus communication system and method based on pre-shared key |
| CN110430014B (en) * | 2019-07-19 | 2022-02-01 | 河海大学 | Hardware encryption gateway and encryption method for field bus channel encryption |
| CN110557244B (en) * | 2019-09-06 | 2021-12-28 | 江苏省水文水资源勘测局 | Application data unit encryption method in water conservancy industrial control system |
-
2019
- 2019-07-19 CN CN201910653667.4A patent/CN110430014B/en active Active
-
2020
- 2020-04-21 WO PCT/CN2020/085959 patent/WO2021012728A1/en active Application Filing
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8363837B2 (en) * | 2005-02-28 | 2013-01-29 | HGST Netherlands B.V. | Data storage device with data transformation capability |
| JP2008299683A (en) * | 2007-06-01 | 2008-12-11 | Nippon Telegr & Teleph Corp <Ntt> | Security method for information recording medium, information processing device, and program |
| CN101799681A (en) * | 2010-02-10 | 2010-08-11 | 刘文祥 | Intelligent grid |
| CN102014015A (en) * | 2010-06-29 | 2011-04-13 | 北京飞天诚信科技有限公司 | Self-checking method of intelligent secret key equipment |
| CN102411352A (en) * | 2011-11-02 | 2012-04-11 | 北京必创科技有限公司 | Wireless analog control method, device and system |
| CN103679062A (en) * | 2013-12-23 | 2014-03-26 | 上海贝岭股份有限公司 | Intelligent electric meter main control chip and security encryption method |
| CN103872778A (en) * | 2014-03-15 | 2014-06-18 | 内蒙古大唐国际新能源有限公司 | Wind power control center device arranged in redundant mode |
| CN104092772A (en) * | 2014-07-23 | 2014-10-08 | 江苏敏捷科技股份有限公司 | High-speed and high-pass data security storage and transmission method |
| CN107566353A (en) * | 2017-08-21 | 2018-01-09 | 浙江大学 | A kind of industrial control system safety experiment platform for encrypted master experimental study |
| CN109639438A (en) * | 2019-02-26 | 2019-04-16 | 燕山大学 | A kind of SCADA network industries information ciphering method based on digital signature |
Non-Patent Citations (3)
| Title |
|---|
| Double-Hashing Operation Mode for Encryption;Sultan Almuhammadi;《 2017 IEEE 7th Annual Computing and Communication Workshop and Conference (CCWC)》;20170302;全文 * |
| SCADA系统中数据传输安全性研究;王婷婷;《中国优秀硕士学位论文全文数据库 信息科技辑》;20130615(第6期);正文第20、36-45页 * |
| 工业控制系统轻量级数据安全传输的研究;徐珊珊;《中国优秀硕士学位论文全文数据库 信息科技辑》;20160815(第8期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110430014A (en) | 2019-11-08 |
| WO2021012728A1 (en) | 2021-01-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110430014B (en) | Hardware encryption gateway and encryption method for field bus channel encryption | |
| US11086810B2 (en) | Intelligent controller and sensor network bus, system and method including multi-layer platform security architecture | |
| CN111186414A (en) | Automobile Bluetooth key safety management system and method | |
| WO2021042736A1 (en) | Encryption method for application data unit in water conservancy industrial control system | |
| CN101602358A (en) | A kind of engine anti-theft authentication method based on the AES128 cryptographic algorithm | |
| CN104579679B (en) | Wireless public network data forwarding method for agriculture distribution communication equipment | |
| CN111049803A (en) | Data encryption and platform security access method based on vehicle-mounted CAN bus communication system | |
| CN111711686A (en) | Safety protection method based on power distribution terminal | |
| CN103986582A (en) | Data encryption transmission method, device and system based on dynamic encryption technology | |
| CN108011716A (en) | A kind of encryption apparatus and implementation method | |
| CN114270328B (en) | Intelligent controller and sensor network bus and system and method including multi-layered platform security architecture | |
| WO2019221419A1 (en) | Hardware security module | |
| CN103441850A (en) | Wireless security router, power distribution network data transmission system and operating method thereof | |
| CN103093139B (en) | Integrated circuit (IC) card intelligent gas meter information safety management module | |
| CN110321725A (en) | A kind of method and device for preventing from distorting system data and clock | |
| CN115296791B (en) | Replay attack preventing device and method for field bus | |
| CN211630190U (en) | Terminal equipment safety encryption and decryption system based on safety chip | |
| CN210274109U (en) | Ethernet card device supporting encryption function | |
| CN115296791A (en) | Replay attack prevention device and method for field bus | |
| WO2018076299A1 (en) | Data transmission method and device | |
| Luo et al. | An in-vehicle network security protocol based on dynamic encryption | |
| CN203102265U (en) | Solid state disk (SSD) control chip | |
| CN210327601U (en) | Water conservancy thing networking encryption and decryption device based on serial port communication | |
| CN201741156U (en) | Trusted hardware equipment | |
| CN107819788B (en) | Safety encryption system based on power production control and monitoring data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |